Privacy Policy - ScanCDL

ScanCDL.com ("ScanCDL," "we," "us," or "our") operates a trucking industry review platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. Please read this carefully. By using ScanCDL, you consent to the practices described in this Policy.

1. Information We Collect

A. Information You Provide Directly

Account Registration: Company name, email address, password (stored as bcrypt hash), MC number, DOT number, phone number, state of operation.
Reviews & Reports: Content, rating, title, relationship to reviewed party, dates of work, city/state, and any optional details you provide.
Communications: Messages you send us via contact form or email.
Partner Applications: Company details, contact information, partnership type, and description.

B. Information Collected Automatically

Log Data: IP address, browser type, operating system, pages visited, referring URLs, and timestamps — collected on each page visit and at login.
Activity Data: Profiles you view, searches you perform, and reviews you submit — stored in your activity history.
Cookies: Session cookies to maintain your login state. A referral tracking cookie if you arrive via a referral link (expires 30 days). We do NOT use advertising or behavioral tracking cookies.
Device Information: Browser user-agent string collected at login for security purposes (device type identification).

C. Information We Do NOT Collect

Payment card numbers or banking information (handled entirely by third-party payment processors).
Social Security Numbers or full government-issued ID numbers. For the CDL Driver Directory we store at most the last four digits of a CDL for identity-matching — never the full license number.
Biometric identifiers. We do not collect facial-recognition scans or other biometric data (relevant under the Illinois Biometric Information Privacy Act, 740 ILCS 14).
Precise geolocation data.

D. CDL Driver Directory — Identity-Matching Data

For the CDL Driver Directory we display limited identity-matching data so a logged-in industry user can confirm that a community report concerns the same individual and not a person with a similar name. We display only: the driver’s full name and issuing state; the last four digits of the CDL with the remaining digits masked (e.g. TX****4655); and the driver’s birth year only — never the full date of birth. Where a reporter supplies a phone number it is shown masked (area code plus last four, e.g. (713) ***-4789). This data exists solely to disambiguate individuals within community reputation reports and is not provided for, and may not be used for, employment screening or any FCRA-regulated purpose.

2. How We Use Your Information

Platform Operation: To create and manage your account, display your reviews, and operate the platform.
Security & Fraud Prevention: IP address and login history are used to detect suspicious activity, prevent fake reviews, and enforce our Terms of Service.
Communications: To send account-related notifications, password reset emails, and email verification links. We do not send marketing emails without your explicit consent.
Activity History: To provide you with your personal activity log (logins, profiles viewed, referrals, reports submitted). This data is visible only to you.
Analytics: Aggregated, anonymized usage statistics to improve the platform. We do not use third-party analytics that track you across other websites.
Legal Compliance: To respond to lawful requests from law enforcement or comply with applicable law, including subpoenas and court orders.
Credits & Payments: To process credit purchases, maintain your credit balance, and record transaction history.
Referral Program: To track referrals and attribute them correctly to referrers.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information only in these limited circumstances:

Publicly Displayed: Your company name appears on reviews you submit. Your email, phone, and personal details are never publicly displayed.
Service Providers: We share data with trusted vendors who help operate our platform (web hosting, email delivery). These providers are contractually prohibited from using your data for any other purpose.
Payment Processors: When you purchase credits, your payment is processed by a third-party payment processor (Stripe or PayPal). We receive only a transaction confirmation — we never see your full payment details.
API Partners: Approved API partners may receive access to non-personally-identifiable review data (ratings, counts). They do not receive your name, email, IP address, or contact information.
Legal Requirements: We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect rights, property, or safety.
Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may transfer to the acquiring entity, subject to the same privacy protections.

4. FCRA Notice — Not a Consumer Reporting Agency

⚠️ Important Legal Notice: ScanCDL is NOT a Consumer Reporting Agency (CRA) as defined by the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.

Information on ScanCDL may not be used as a factor in establishing a consumer's eligibility for:

Credit or insurance to be used primarily for personal, family, or household purposes
Employment purposes (hiring, firing, promotion, reassignment)
Any other purpose authorized under FCRA

ScanCDL reviews are user-submitted opinions and experiences. They do not constitute official background checks, DAC/HireRight reports, PSP (Pre-Employment Screening Program) records, MVR (Motor Vehicle Records), or any official government or FMCSA record. Always obtain proper FCRA-compliant background checks through authorized providers before making employment decisions.

CDL Driver Directory. The CDL Driver Directory is a community reputation and identity-matching feature, not an employment-screening product. Entries reflect user-submitted opinions and experiences and must not be used to make hiring or other FCRA-regulated decisions. Reports relating to controlled-substance or alcohol violations, refusals, or return-to-duty / SAP status are not hosted on ScanCDL; that information lives only in the official FMCSA Drug & Alcohol Clearinghouse, which is the authoritative source employers must query.

5. Section 230 Notice

ScanCDL is an interactive computer service as defined under Section 230 of the Communications Decency Act (47 U.S.C. § 230). We are not the publisher or speaker of user-submitted reviews and reports. As a platform, we are not liable for content submitted by users.

If you believe a review contains false or defamatory information about you, please contact us at [email protected] or use our Review Removal Request process. We will review all requests and remove content that violates our Terms of Service.

6. Cookies & Tracking

Cookie	Purpose	Duration
PHPSESSID	Login session	Session (closes with browser)
scancdl_ref	Referral tracking	30 days

We do not use Google Analytics, Facebook Pixel, advertising networks, or any third-party behavioral tracking cookies. You can disable cookies in your browser settings; however, doing so will prevent you from logging in.

7. Data Retention

Account Data: Retained for the lifetime of your account. Upon account deletion, your personal data (email, password, contact info) is removed within 30 days.
Reviews: Published reviews may remain after account deletion in anonymized form (company name replaced with "Anonymous Carrier") unless you specifically request full removal.
Login History: Last 30 login records retained for security purposes. Older records are automatically deleted.
IP Addresses: Retained for up to 12 months for fraud prevention and legal compliance.
Credit Transactions: Retained for 7 years for financial record-keeping and tax compliance.
Activity History (profiles viewed): Last 50 records retained. Older records are automatically deleted.
CDL Driver Directory Records: Identity-matching fields (name, state, masked CDL, birth year) and associated community reports are retained while the entry remains active. If a report is removed through our Review Removal process, it is deleted within 30 days; a driver entry with no remaining reports is deactivated and removed from public view.

8. Data Security

All passwords hashed using bcrypt (cost factor 12) — we cannot read your password.
All data transmitted over HTTPS/TLS encryption.
Database access restricted to authorized server-side code only.
Cache files stored outside the web-accessible directory.
Cloudflare WAF (Web Application Firewall) and DDoS protection active.
Regular automated backups.

While we implement industry-standard security measures, no method of transmission over the internet is 100% secure. In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of all personal data we hold about you.
Correction: Update or correct inaccurate information via Account Settings.
Deletion: Request deletion of your account and personal data ("right to be forgotten").
Portability: Request your data in a machine-readable format.
Opt-Out: Opt out of any future marketing communications at any time.
Review Removal: Request removal of a review about you via our Review Removal process.

California Residents (CCPA): You have the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information (we do not sell personal information). To exercise your California privacy rights, contact us at [email protected].

10. Children's Privacy

ScanCDL is intended exclusively for adults 18 years of age or older. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it immediately. If you believe we have inadvertently collected such information, contact us at [email protected].

11. Third-Party Links

Our platform may contain links to third-party websites (e.g., FMCSA, company websites listed in reviews). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. Your continued use of ScanCDL after any changes constitutes acceptance of the updated Policy.

13. Contact Us

For privacy-related questions, data requests, or concerns:

ScanCDL.com
Email: [email protected]
Website: www.scancdl.com

We aim to respond to all privacy requests within 30 business days.